CVE-2016-1978 Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to...
HighCVSS 7.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.21-1 | 2:3.21-1 |
| debian/nss(Debian:13) | < 2:3.21-1 | 2:3.21-1 |
| debian/nss(Debian:14) | < 2:3.21-1 | 2:3.21-1 |
| mozilla Firefox | <= 43.0.4 | No fix listed |
| mozilla network security services | <= 3.20.1 | No fix listed |
References
- Debian Security Tracker CVE-2016-1978 vendor-advisory
- SUSE-SU-2016:0727 vendor-advisory
- SUSE-SU-2016:0777 vendor-advisory
- SUSE-SU-2016:0820 vendor-advisory
- SUSE-SU-2016:0909 vendor-advisory
- RHSA-2016:0591 vendor-advisory
- RHSA-2016:0684 vendor-advisory
- RHSA-2016:0685 vendor-advisory
- DSA-3688 vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 84275 vdb-entry
- 91787 vdb-entry
- 1035258 vdb-entry
- USN-2973-1 vendor-advisory
- bto.bluecoat.com
- bugzilla.mozilla.org
- developer.mozilla.org
- GLSA-201605-06 vendor-advisory